Researchers Demonstrate OpenBSD Root Exploit Chaining 37-Year-Old Shared-Memory Bug

Researchers from security firm Calif demonstrated a local privilege escalation exploit against OpenBSD 7.9 that chains two kernel vulnerabilities: a 37-year-old integer overflow in the shmat(4) system call and a reference-counting use-after-free flaw. The exploit bypasses OpenBSD's KARL kernel-address randomization as well as SMAP and SMEP hardware protections by leveraging predictable kernel memory allocators. Full proof-of-concept code was published alongside a detailed writeup after OpenBSD released patches in September. There is no evidence of prior exploitation in the wild.

AI-extracted · verify before operational use